class Puppet::Network::AuthConfig

# File lib/puppet/network/authconfig.rb, line 71
def initialize(rights=nil)
  @rights = rights || Puppet::Network::Rights.new
  insert_default_acl
end

# File lib/puppet/network/authconfig.rb, line 64
def check_authorization(indirection, method, key, params)
  if authorization_failure_exception = @rights.is_request_forbidden_and_why?(indirection, method, key, params)
    Puppet.warning("Denying access: #{authorization_failure_exception}")
    raise authorization_failure_exception
  end
end

# File lib/puppet/network/authconfig.rb, line 35
def insert_default_acl
  DEFAULT_ACL.each do |acl|
    unless rights[acl[:acl]]
      Puppet.info "Inserting default '#{acl[:acl]}' (auth #{acl[:authenticated]}) ACL"
      mk_acl(acl)
    end
  end
  # queue an empty (ie deny all) right for every other path
  # actually this is not strictly necessary as the rights system
  # denies not explicitely allowed paths
  unless rights["/"]
    rights.newright("/").restrict_authenticated(:any)
  end
end

# File lib/puppet/network/authconfig.rb, line 50
def mk_acl(acl)
  right = @rights.newright(acl[:acl])
  right.allow(acl[:allow] || "*")

  if method = acl[:method]
    method = [method] unless method.is_a?(Array)
    method.each { |m| right.restrict_method(m) }
  end
  right.restrict_authenticated(acl[:authenticated]) unless acl[:authenticated].nil?
end